Finding and blocking malicious mailbox forwarding rules

Inbox rules and mailbox forwarding give an attacker persistence and stealth. Microsoft's phishing investigation playbook tells responders to check every affected mailbox for both SMTP forwarding and inbox rules that forward to external recipients, and to look out for rules with keyword conditions like 'all mail with the word invoice in the subject'.

We see a few recurring patterns in business email compromise:

• Forward all mail, or mail matching 'invoice', 'payment', 'wire' or 'bank', to an external address so the attacker keeps reading after they lose access.
• Move messages from a specific client or the accounts payable team to RSS Feeds, Archive or Conversation History and mark them read, so the real owner never sees the 'did you change your bank details?' reply.
• Delete messages containing words like 'hacked', 'phishing' or 'suspicious' so warnings from colleagues disappear.
• Rules with meaningless names (a single dot, or '..') that are easy to miss in Outlook.

1. 01

   Check mailbox-level SMTP forwarding for every mailbox

   Microsoft's playbook uses Exchange Online PowerShell: Get-Mailbox -RecipientTypeDetails UserMailbox -ResultSize unlimited, showing ForwardingSmtpAddress and DeliverToMailboxAndForward, exported to CSV. Any external address there needs an owner and a reason.

2. 02

   List inbox rules for suspect mailboxes

   Get-InboxRule -Mailbox user@yourcompany.ca lists a mailbox's rules; pipe a single rule to Format-List to see its conditions and actions. Look for ForwardTo, ForwardAsAttachmentTo, RedirectTo, DeleteMessage and MoveToFolder actions.

3. 03

   Search the audit log for rule creation

   Search-UnifiedAuditLog with -RecordType ExchangeAdmin -Operations New-InboxRule (and Set-InboxRule) over the investigation window shows when rules were created and from what IP. Rules created in Outlook desktop may appear as UpdateInboxRules. Also search Remove-InboxRule: attackers sometimes clean up.

4. 04

   Use the Auto-forwarded messages report

   Microsoft points to the Auto-forwarded messages report in the Exchange admin centre as another source showing who is forwarding externally.

5. 05

   Check the other forwarding paths

   Mail flow (transport) rules created by a compromised admin, delegate permissions on the mailbox, and connected apps with mail permissions can all exfiltrate mail without an inbox rule.

The strongest preventive control is to stop automatic forwarding to external recipients at the tenant level. In the Microsoft Defender portal, outbound spam filter policies have an Automatic forwarding rules setting with three values:

• Set the default policy explicitly to Off rather than relying on System-controlled.
• If a few people genuinely need to forward externally (a shared mailbox to an outsourced bookkeeper, say), create a separate custom outbound spam policy for just those users with forwarding On, and document it.
• Internal forwarding between your own users isn't affected.

Microsoft describes two other controls that interact with the outbound policy. Remote domains in the Exchange admin centre can allow or block automatic forwarding to all external domains or specific ones. Mail flow rules can detect and block messages automatically forwarded to external recipients. If any of these layers blocks the forward, the message is blocked. A common pattern is to leave the outbound policy permissive for a named group, but use a remote domain entry so forwarding only reaches one approved partner domain.

• Microsoft's default alert policies include 'Creation of forwarding/redirect rule', which fires when someone creates an inbox rule that forwards or redirects mail. Microsoft notes it only tracks rules created in Outlook on the web or Exchange Online PowerShell, so it won't see every rule.
• 'Suspicious email forwarding activity' alerts when a user auto-forwards to a suspicious external account.
• Make sure alert notifications go to a monitored mailbox or ticket queue, not a former employee's inbox.
• Review the Auto-forwarded messages report monthly even without alerts.

Sources: Microsoft Learn: 'Phishing investigation' incident response playbook, 'Control automatic external email forwarding' (Defender for Office 365), 'Detect and remediate Outlook rules and custom forms injections attacks', 'Alert policies in the Microsoft Defender portal', and 'Turn auditing on or off' (Microsoft Purview).

1. 01

   Preserve before you delete

   Export the rule details (Get-InboxRule ... | Format-List) and the related audit entries. The rule's conditions show what the attacker cared about; the creation IP and time anchor the timeline.

2. 02

   Contain the account

   Reset the password, revoke sessions, review MFA methods and app consents, then remove the rule and any forwarding.

3. 03

   Scope the exposure

   Work out what was forwarded and to whom. That determines whether clients or vendors need warning and whether personal information was exposed.

4. 04

   Check for fraud in progress

   Look for payment-change requests sent from or received by the mailbox during the compromise and call the counterparties on known numbers.

5. 05

   Assess notification duties

   If personal information was exposed, Canadian privacy law may require reporting. Talk to your counsel early.